| <<< plug and play | Index | deleted file >>> |
When would you have to "chain the FAT" to recover a deleted file?
Following a cluster chain in the FAT is only necessary if the file you are trying to carve occupies more than one cluster.
When file is deleted, FAT entries are reset to zero to mark available clusters.
Because of that, there may be a need to manually "chain the FAT" to reproduce cluster numbers which used to belong to the deleted file.
| <<< plug and play | Index | deleted file >>> |